4 ms·

There is a reason why people moved away from distorted text based captcha. We are basically at the point where computers are better at them then humans. https:

There is a reason why people moved away from distorted text based captcha. We are basically at the point where computers are better at them then humans. https://www.usenix.org/system/files/conference/woot14/woot14-bursztein.pdf https://www.usenix.org/system/files/conference/woot14/woot14... is a paper on the subject i think is really interesting However a surprising amount of text based captchas can be solved in a few line shell script of, using imagemagik to convert to greyscale, dilate and undilate, then pass to teserract However there are also sites like https://2captcha.net https://2captcha.net , so really captchas are more like putting a small min amount of effort.

noprocrasted 2y ago
Just because you can technically crack them doesn't mean they're useless. There's a significant amount of time, skill and effort that went into the solution from this post, and the end result doesn't generalize well (you'd have to start all over for a different kind of captcha). The vast majority of spammers would not be able to replicate this; those who do would either make money legitimately, or focus their skills on juicier targets (if you have AI/ML skills and want to do nefarious things there are other options that pay much better than spamming). Such captchas still work well at raising the cost of successful spamming above the expected payoff from said spam.
- deleted 2y ago
  [deleted]
- fragmede 2y ago
  > there are other options that pay much better than spamming Are there? Say you've got a felony record and can't get a legit AI/ML job at eg OpenAI/anywhere. What would you do instead? most of the options I can think of involve getting paid for doing things that are basically spam if you zoom out enough.
  - noprocrasted 2y ago
    There's plenty of mischief potential with "deepfakes".
  - andrewflnr 2y ago
    How many people are there like that, and how much damage are they collectively likely to do? If you're a random spammer, how hard will it be to hire that person? Again, not aiming for impossibility, just reducing the damage.
    - TravisPeacock 2y ago
      I've been working for myself for over a decade doing random projects for clients while also doing my own thing. My resume looks awful and the job market is trash. If be willing to take a job as a jr developer and work my way up (or a sys admin). I used to run one of the world's largest ebook piracy websites but want to put that life behind me. Recently work came across my desk to create tens of thousands of accounts on a well respected website so they could more easily scrape it. I just want a traditional job, but I also want to support my family and $4000 for a months work
      - supriyo-biswas 2y ago
        If I were you, I'd probably try looking at companies working in the web scraping and reverse engineering fields, who might even appreciate the skills even if they were acquired in a, let's just say, "different" way.
      - noprocrasted 2y ago
        There's nothing immoral about scraping a website. Best of luck to you!
      - mmsc 2y ago
        The secret is knowing that companies actually want people like you, with the real world blackhat experience, because you know how the game works in practise not just theory.
  - benreesman 2y ago
    I’ve got no criminal charges of any kind and I’d still want to know about any way to work without getting flagged as a known enemy of the Cartel. I’m lucky that some people still want chops no matter the thought crime, I’m very grateful such excellent employers exist (love you guys). But you’re never sure you’ll line up two such in a row, this isn’t the IBM until company casket and company funeral days. Makes life “interesting” even for a risk-taker.
- reaperman 2y ago
  So, I do this type of AI development for solving CAPTCHAs. I can't get any real jobs that pay me for my more advanced skills. My primary sins were going to a second/third-tier university and some performance concerns in a portion of my previous roles due to divorce and burn-out. I make $80k/year in government IT, and $30-150k/year as the "AI" guy in a small 2-5 person group that offers a CAPTCHA-breaking API. The spammers aren't the ones replicating this. They just pay B2B rates (combo of SaaS + Consulting, depending on client needs) to help them remove the roadblocks.
  - blackjackfoe 2y ago
    Is your company hiring? :)
  - benreesman 2y ago
    If there were a totally 100% aboveboard way to do this in a net transfer of utility from Tessier-Ashopool SA to the typical web surfer I would be a superfan.
  - HeckFeck 2y ago
    Why do you do this? While I can appreciate the technical achievement, you know most users of forums and imageboards don’t want any AI content at all.
    - KomoD 2y ago
      > Why do you do this? Money, obviously. I'd also do it for $30-150k/year > you know most users of forums and imageboards don’t want any AI content at all. He's not creating or posting any "AI content"?
      - HeckFeck 2y ago
        Okay, but you know his actions are enabling more AI content and spam to proliferate? I hardly think he is making that much money just because legitimate users don't want to fill in a captcha.
- delfinom 2y ago
  >he vast majority of spammers would not be able to replicate this; Eh? They just need to buy their software from someone that can. I would say many of the malware and spamware isn't created by every individual deploying it, but instead vendors that got good at it and decide to make revenue by licensing out their software to other bad actors.
- hamilyon2 2y ago
  Captchas are now useful to distinguish well-intentioned bots (they stop whenever they see captcha) from malicious ones, which solve them, but still behave a lot like bots. Well-intentional bots are first-class citizens
  - brookst 2y ago
    Wouldn’t a well-intentioned bot follow robots.txt anyway?
    - hamilyon2 2y ago
      Curl and libcurl doesn't. Wget doesn't, I think.
      - account42 2y ago
        CURL isn't a bot, it's a tool. It can be part of a bot (which may or may not respect robots.txt) but it can also just act as a user agent directly for a human operator in which case it SHOULD just do what asked. Chrome doesn't follow robots.txt either for the same reason.
  - lostlogin 2y ago
    Do you complete the circle and do the good bot bad bot classification with a mod bot?
- atomicnumber3 2y ago
  The watershed of "good enough at programming to just get a real job" vs "can code enough to be really annoying to businesses, but not enough to hack it as a dev" is a lot more on the annoying side than you'd think. I say this with the chagrin of someone who works on a cool software product that is also coincidentally really well-shaped to make people want to abuse it.
- TZubiri 2y ago
  Interesting, subtle difference but I always thought of captchas as having computational difficulty, but that's clearly not the point as you say. The cost is not compute but developer time. If you manage crack it at 1mhz per captcha or 1ghz or 1000ghz, it makes no difference, as the bottleneck is the network identifier (ip address/block) While still a type of PoW, these economics are different than offline mechanisms like password hashing or crypto. Where a 1ghz cost is still significantly different than 1mhz.
brian-armstrong 2y ago
Makes me wonder what comes next. Could we create a forum where every member must do a 15 minute video interview with a moderator? I know this "doesn't scale" but I think it could make for a funny gimmick.
- deleted 2y ago
  [deleted]
- jabroni_salad 2y ago
  private torrent trackers are/were doing that. It was really just to make sure you understood how p2p culture works and what the expectations are, and really easy to pass if you just followed a guide. However, I did see many people fail their interview.
  - jmb99 2y ago
    Was there ever video interviews? Admittedly I wasn’t really paying attention but back when I was getting into what it was only IRC, and these days it still seems to be IRC anywhere that does interviews (otherwise class-restricted forum invites).
    - jabroni_salad 2y ago
      I dont recall ever seeing that. I dont think anyone doing piracy wants to be photographed or videoed lol. I did get in mumble with some community members but it was just a hangout.
  - bdjsiqoocwk 2y ago
    [dead]
  - drexlspivey 2y ago
    The famous RED tracker has a full on technical interview asking about: * Audio Formats * Transcoding * Spectral analysis and more. This is the interview prep website: https://interviewfor.red/en/index.html https://interviewfor.red/en/index.html
RobotToaster 2y ago
> so really captchas are more like putting a small min amount of effort. At that point a proof of work captcha (mCaptcha.org is one, but there are others), is probably the best option. Especially with how any reasonably effective traditional captcha is an accessibility nightmare.
- cubefox 2y ago
  It's completely unclear what a "proof of work" captchas is supposed to be.
  - porridgeraisin 2y ago
    Brave search uses it. From my limited understanding, it sends a time-consuming javascript function and its input to your browser, and has your browser calculate the output and send it back. The server matches your output with the expected output. I assume the server would pre-compute in some way? On the spectrum, it leans more towards being a spam-alleviating thing rather than a human-distinguishing thing.
    - porridgeraisin 2y ago
      > pre-compute Or it could be a SAT or something that's easy to verify and hard to solve.
      - shreyshnaccount 2y ago
        id think its some kind of proof of sequential work, basically an un-parallelizable calculation that is guaranteed to take a certain number of steps, and making solving thousands of them much harder and hopefully not worth it
  - jamesnorden 2y ago
    It's CPU intensive JS code that must run to get an output that must match something server-side, the idea is that it makes attacks/spam not economically viable to run.
3abiton 2y ago
I think captchas are just another lind of defense to make it harder for actors abusing the system. It's not a solution, just a little (getting outdated) fortification.
poincaredisk 2y ago
Small? From your own link, recaptcha v3 takes 10-15s and costs $1.3 for 1000 captchas. This is actually huge, and cost prohibitively expensive for many things where you would want to use it (like scrapping a large website).
- costco 2y ago
  Depends on the website, but you don't get always get a recaptcha, so the cost is a lot lower than that. You usually get it if you're exceeding some rate limit or you're doing a sensitive action like registering.
nyclounge 2y ago
Wow Funcaptcha cost the most and it is open source.

noprocrasted 2y ago

Just because you can technically crack them doesn't mean they're useless. There's a significant amount of time, skill and effort that went into the solution from this post, and the end result doesn't generalize well (you'd have to start all over for a different kind of captcha). The vast majority of spammers would not be able to replicate this; those who do would either make money legitimately, or focus their skills on juicier targets (if you have AI/ML skills and want to do nefarious things there are other options that pay much better than spamming). Such captchas still work well at raising the cost of successful spamming above the expected payoff from said spam.

deleted 2y ago
[deleted]
fragmede 2y ago
> there are other options that pay much better than spamming Are there? Say you've got a felony record and can't get a legit AI/ML job at eg OpenAI/anywhere. What would you do instead? most of the options I can think of involve getting paid for doing things that are basically spam if you zoom out enough.
- noprocrasted 2y ago
  There's plenty of mischief potential with "deepfakes".
- andrewflnr 2y ago
  How many people are there like that, and how much damage are they collectively likely to do? If you're a random spammer, how hard will it be to hire that person? Again, not aiming for impossibility, just reducing the damage.
  - TravisPeacock 2y ago
    I've been working for myself for over a decade doing random projects for clients while also doing my own thing. My resume looks awful and the job market is trash. If be willing to take a job as a jr developer and work my way up (or a sys admin). I used to run one of the world's largest ebook piracy websites but want to put that life behind me. Recently work came across my desk to create tens of thousands of accounts on a well respected website so they could more easily scrape it. I just want a traditional job, but I also want to support my family and $4000 for a months work
    - supriyo-biswas 2y ago
      If I were you, I'd probably try looking at companies working in the web scraping and reverse engineering fields, who might even appreciate the skills even if they were acquired in a, let's just say, "different" way.
    - noprocrasted 2y ago
      There's nothing immoral about scraping a website. Best of luck to you!
    - mmsc 2y ago
      The secret is knowing that companies actually want people like you, with the real world blackhat experience, because you know how the game works in practise not just theory.
- benreesman 2y ago
  I’ve got no criminal charges of any kind and I’d still want to know about any way to work without getting flagged as a known enemy of the Cartel. I’m lucky that some people still want chops no matter the thought crime, I’m very grateful such excellent employers exist (love you guys). But you’re never sure you’ll line up two such in a row, this isn’t the IBM until company casket and company funeral days. Makes life “interesting” even for a risk-taker.
reaperman 2y ago
So, I do this type of AI development for solving CAPTCHAs. I can't get any real jobs that pay me for my more advanced skills. My primary sins were going to a second/third-tier university and some performance concerns in a portion of my previous roles due to divorce and burn-out. I make $80k/year in government IT, and $30-150k/year as the "AI" guy in a small 2-5 person group that offers a CAPTCHA-breaking API. The spammers aren't the ones replicating this. They just pay B2B rates (combo of SaaS + Consulting, depending on client needs) to help them remove the roadblocks.
- blackjackfoe 2y ago
  Is your company hiring? :)
- benreesman 2y ago
  If there were a totally 100% aboveboard way to do this in a net transfer of utility from Tessier-Ashopool SA to the typical web surfer I would be a superfan.
- HeckFeck 2y ago
  Why do you do this? While I can appreciate the technical achievement, you know most users of forums and imageboards don’t want any AI content at all.
  - KomoD 2y ago
    > Why do you do this? Money, obviously. I'd also do it for $30-150k/year > you know most users of forums and imageboards don’t want any AI content at all. He's not creating or posting any "AI content"?
    - HeckFeck 2y ago
      Okay, but you know his actions are enabling more AI content and spam to proliferate? I hardly think he is making that much money just because legitimate users don't want to fill in a captcha.
delfinom 2y ago
>he vast majority of spammers would not be able to replicate this; Eh? They just need to buy their software from someone that can. I would say many of the malware and spamware isn't created by every individual deploying it, but instead vendors that got good at it and decide to make revenue by licensing out their software to other bad actors.
hamilyon2 2y ago
Captchas are now useful to distinguish well-intentioned bots (they stop whenever they see captcha) from malicious ones, which solve them, but still behave a lot like bots. Well-intentional bots are first-class citizens
- brookst 2y ago
  Wouldn’t a well-intentioned bot follow robots.txt anyway?
  - hamilyon2 2y ago
    Curl and libcurl doesn't. Wget doesn't, I think.
    - account42 2y ago
      CURL isn't a bot, it's a tool. It can be part of a bot (which may or may not respect robots.txt) but it can also just act as a user agent directly for a human operator in which case it SHOULD just do what asked. Chrome doesn't follow robots.txt either for the same reason.
- lostlogin 2y ago
  Do you complete the circle and do the good bot bad bot classification with a mod bot?
atomicnumber3 2y ago
The watershed of "good enough at programming to just get a real job" vs "can code enough to be really annoying to businesses, but not enough to hack it as a dev" is a lot more on the annoying side than you'd think. I say this with the chagrin of someone who works on a cool software product that is also coincidentally really well-shaped to make people want to abuse it.
TZubiri 2y ago
Interesting, subtle difference but I always thought of captchas as having computational difficulty, but that's clearly not the point as you say. The cost is not compute but developer time. If you manage crack it at 1mhz per captcha or 1ghz or 1000ghz, it makes no difference, as the bottleneck is the network identifier (ip address/block) While still a type of PoW, these economics are different than offline mechanisms like password hashing or crypto. Where a 1ghz cost is still significantly different than 1mhz.

brian-armstrong 2y ago

Makes me wonder what comes next. Could we create a forum where every member must do a 15 minute video interview with a moderator? I know this "doesn't scale" but I think it could make for a funny gimmick.

deleted 2y ago
[deleted]
jabroni_salad 2y ago
private torrent trackers are/were doing that. It was really just to make sure you understood how p2p culture works and what the expectations are, and really easy to pass if you just followed a guide. However, I did see many people fail their interview.
- jmb99 2y ago
  Was there ever video interviews? Admittedly I wasn’t really paying attention but back when I was getting into what it was only IRC, and these days it still seems to be IRC anywhere that does interviews (otherwise class-restricted forum invites).
  - jabroni_salad 2y ago
    I dont recall ever seeing that. I dont think anyone doing piracy wants to be photographed or videoed lol. I did get in mumble with some community members but it was just a hangout.
- bdjsiqoocwk 2y ago
  [dead]
- drexlspivey 2y ago
  The famous RED tracker has a full on technical interview asking about: * Audio Formats * Transcoding * Spectral analysis and more. This is the interview prep website: https://interviewfor.red/en/index.html https://interviewfor.red/en/index.html

RobotToaster 2y ago

> so really captchas are more like putting a small min amount of effort. At that point a proof of work captcha (mCaptcha.org is one, but there are others), is probably the best option. Especially with how any reasonably effective traditional captcha is an accessibility nightmare.

cubefox 2y ago
It's completely unclear what a "proof of work" captchas is supposed to be.
- porridgeraisin 2y ago
  Brave search uses it. From my limited understanding, it sends a time-consuming javascript function and its input to your browser, and has your browser calculate the output and send it back. The server matches your output with the expected output. I assume the server would pre-compute in some way? On the spectrum, it leans more towards being a spam-alleviating thing rather than a human-distinguishing thing.
  - porridgeraisin 2y ago
    > pre-compute Or it could be a SAT or something that's easy to verify and hard to solve.
    - shreyshnaccount 2y ago
      id think its some kind of proof of sequential work, basically an un-parallelizable calculation that is guaranteed to take a certain number of steps, and making solving thousands of them much harder and hopefully not worth it
- jamesnorden 2y ago
  It's CPU intensive JS code that must run to get an output that must match something server-side, the idea is that it makes attacks/spam not economically viable to run.

3abiton 2y ago

I think captchas are just another lind of defense to make it harder for actors abusing the system. It's not a solution, just a little (getting outdated) fortification.

poincaredisk 2y ago

Small? From your own link, recaptcha v3 takes 10-15s and costs $1.3 for 1000 captchas. This is actually huge, and cost prohibitively expensive for many things where you would want to use it (like scrapping a large website).

costco 2y ago
Depends on the website, but you don't get always get a recaptcha, so the cost is a lot lower than that. You usually get it if you're exceeding some rate limit or you're doing a sensitive action like registering.

nyclounge 2y ago

Wow Funcaptcha cost the most and it is open source.